4

Hey everyone, I am playing around with ASP.NET MVC and Entity Framework. I was wondering what is the best way to deal with passing around data from controllers to views and then back. I will explain a little better:

I have an action that is for creating a new "Receipt" object

        [Authorize]
    public ActionResult CreateReceipt(int id)
    {
           //I create the receipt object
            Receipt newReceipt = new Receipt();
           // assign some information about the owner of the receipt 
           // and the group that it belongs to
            newReceipt.Group = group;
            newReceipt.Owner = user;
            //send off to the view to be displayed
            return View(newReceipt);
    }

So I basically create a receipt and pre-fill in some information (including the authorized user and some group ID information) I can then send that to a view with all sorts of form elements that let the user fill in the other missing fields and submit so that a new receipt is added. This all works great if all the fields from the receipt object are being displayed on the form.

If I remove the form elements for things that the user shouldn't be touching (such as the group number, the user id that the receipt belongs to, etc...) Then when I submit the form and pick it up in the controller:

        [HttpPost]
    [Authorize]
    public ActionResult CreateReceipt(Receipt receipt)
    {

        if (ModelState.IsValid)
        {
            using (EntityFrameworkEntities context = new EntityFrameworkEntities)
            {
                context.AddToReceipts(receipt);
                context.SaveChanges();
            }
            return RedirectToAction("Index");
        }

        return View(receipt);
    }

Then all that handy preloaded information that I filled in and sent to the view doesn't come back with the post. I know I could place the UserID or the GroupID into a hidden field and then it makes it back with the POST, but that feels wrong. Technically someone could go in, change the hidden values and resubmit the post. I could then do checking to make sure that everything should be where it belongs, but that also feel like another trip to the database to get information that I already got once.

If anyone can elaborate a bit on what the standard way of passing data around from model to view to controller, that would be great. Thank you for your time and help!

Improve this question

2 Answers 2

Reset to default
5

If you're worried about someone monkeying with hidden field values to affect other records, pad the ID value and encrypt it in the hidden field, then decrypt on postback.

Improve this answer
Sign up to request clarification or add additional context in comments.

5 Comments

+1, this is the primary answer, I added some more around the answer to be more directly helpful
This does seem like a great solution to really protect against tampering and all, I was more asking because it seems like I shouldn't have to litter my form with hidden fields but somehow keep the values that were sent to the view along for the round trip. I could be wrong, but I guess that was the point of posting the question :-) I will for sure look into doing this as well. Thank you for the info!
If you're wanting to get away from having the id field in the page at all, you'd still have to devise some other way to pass the id to the client so it can be passed back on postback. No way around that.
Yeah it's got to exist in the view somewhere, otherwise the id will be null on model binding. Eek!
@OP having previously been a webforms developer and working with webforms and viewstate I always felt unclean working with hidden fields on pages that it was a kludge, but after doing more and more with MVC working with hidden fields this way is how the internet is meant to behave.
3

I just recently added functionality like this to one of my existing applications. This is going to expand upon the answer from @Dave Swersky

Assuming a business object of 

Receipt
ID
Cost
ShippingAddress

I would have a ViewModel 

ReceiptViewModel
ID
Cost
CostHash
ShippingAddress

Your view would have something like

Html.HiddenFor(m => m.Id)
Html.HiddenFor(m => m.CostHash)
Html.LabelFor(m => m.Cost)
Html.LabelFor(m => m.ShippingAddress)

Then for your mapping of business object to viewmodel it's straight forward except for the CostHash you want to calculate the Sha256 hash (or other hash) of Cost + Private Key + Predicable Salt Value (such as the ID of the receipt itself). The reason you want to include the ID of the object or some other variable but known value is so that users of your system can't bypass your hashing.

If you would only use the original value + private key, if the cost was $10 the output would be the same for $10 everytime. This would allow a person to easily transpose both the Cost value and the CostHash value from a different receipt, however if you add in the ID to be part of the salt the hash for $10 for Receipt 1 will be different than $10 for Receipt 2. If you have many similar values to protect on the same object that you're still worried that users could take the Cost and CostHash values and move them to say a different line item you would need to add more to the salt such as the property name of the item etc.

When the view model is sent back to the controller you want to calculate the expected hash of Cost and compare it with the CostHash property and verify they are equal. If they are different that would imply attempted tampering.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.